Attacks continued through January, with China-backed hackers targeting devices linked to universities, telecoms, and ISPs, undeterred by significant media coverage and US sanctions.

Threat intelligence firm Recorded Future said it had observed Salt Typhoon breaching 5 telcos between December 2024 and January 2025.

Security researchers from Recorded Future observe new Salt Typhoon activity The threat actor is still going after ISPs and universities in the west The group is abusing flaws in Cisco gear to hit new targets Salt Typhoon,

Despite high-profile attention and even US sanctions, the group hasn’t stopped or even slowed its operation, including the breach of two more US telecoms.

China's Salt Typhoon hackers are still actively targeting telecoms worldwide and have breached more U.S. telecommunications providers via unpatched Cisco IOS XE network devices.

Recorded Future’s latest findings shed light on how widespread the Salt Typhoon campaign has become since it was uncovered last year.

Chinese APT Salt Typhoon has been exploiting known vulnerabilities in Cisco devices in attacks on telecom providers in the US and abroad.

Salt Typhoon continues its attacks against telecoms, security researchers reveal. According to the report, Salt Typhoon—tracked by Recorded Future as “RedMike”—breached up

Networks in US and beyond compromised by Beijing's super-snoops China's Salt Typhoon spy crew exploited vulnerabilities in Cisco devices to compromise at least seven devices linked to global telecom providers and other orgs,